Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the following iptables rule:

iptables -A INPUT -p icmp -m icmp --icmp-type 255 -j ACCEPT

I am not sure what the point of "-m" is given that "-p" is already present. Does it serve any purpose in this case? Can the above be simplified to one of the below while retaining all the functions?

iptables -A INPUT -p icmp --icmp-type 255 -j ACCEPT


iptables -A INPUT -m icmp --icmp-type 255 -j ACCEPT

Thanks for any tips.

share|improve this question
up vote 4 down vote accepted

-p specifies the protocol while -m specifies the matching module which is used. The matching module might have a different type or you could specify multiple modules there. This is why you need separate flags. See the iptables manpage section MATCH EXTENSIONS for the various uses of -m.

However, in your case -p x implies -m x, so the second rule works equally well as the first one. The third rule is invalid. Though -m can stand alone in some cases, you have to use it along -p here as you cannot use a (protocol) matching module without explicitly specifying the protocol.

share|improve this answer
Extensions like state, conntrack, etc. – Hello71 Feb 2 '13 at 2:37
Correct, -m state does not need a protocol. -m multiport <portlist> does, for another famous example. See the manpage for more. – Karma Fusebox Feb 2 '13 at 2:42
To clarify things a bit, think of -m and -j as plugins that load additional functionality and allow additional command parameters to be understood. For example, --comment is meaningless to the iptables command until -m comment is specified. You can find a description of loadable -m (matching) and -j (target) modules and the additional parameters they enable in the iptables manual page. – Andrew B Feb 2 '13 at 6:03
Actually, IIRC, -j doesn't load a module; it jumps to an already known target. – Hello71 Feb 2 '13 at 13:10
thank you for the answer and for the comments. i have been reading up on the iptables command but it seems that the following syntax is valid: iptables -A INPUT -m tcp ...... but your answer suggests this is not correct? can you please clarify. Thanks again. – tonytz Feb 3 '13 at 1:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.